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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Claims 1-14 (Canceled) 

Claim 15 (Currently Amended): A system for identifying service abuse, comprising: 

a plurality of server computers each adapted to receive an event and to create an event 
packet in response to the event; 

a cluster host adapted to receive a plurality of event packets from at least a portion of the 
plurality of server computers and to update a master screening table in response to the plurality of 
event packets[[; and]]., 

wherein the cluster host is further adapted to communicate a local screening table 
comprising at least a portion of the master screening table to each of the plurality of server 
computers, and each of the plurality of server computers is adapted to xiisregard an event matching a 
portion of the local licrcening table 

receive the local screening table from the cluster host; 

receive an event requesting a service; 

create an event identification associated with the event; 

select a table entry from a plurality of table entries in the local screening table as a 
selected table entry; 

increment a first count value associated with a first table entry of the plurality of table 
entries in the local screening table in response to the event identification matching an event 
identification associated with the first table entry; 

decrement a second count value associated with the selected table entry of the plurality 
of table entries in response to the event identification failing to match an event identification 
associated with the selected table entry; 
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replace the selected table entry with the event identification associated with the received 
event in response to the second count value equaling a predetermined value; and 

determine a metric value for the event from the local screening table, the metric value 
indicating that the event is an abusive request . 

Claim 16 (Original): The system of claim 15, wherein the local screening table is a copy of 
the master screening table. 

Claim 17 (Previously Presented): The system of claim 15, wherein each event packet 
includes an event identification associated with an event. 

Claim 18 (Original): The system of claim 17, wherein the event identification corresponds 
with the identity of a user. 

Claim 19 (Original): The system of claim 18, wherein the event identification includes an IP 
address. 

Claim 20 (Original): The system of claim 18, wherein the event identification includes a 
user identification. 

Claim 21 (Original): The system of claim 17, wherein the event identification corresponds 
with a content value included in the event. 

Claim 22 (Original): The system of claim 21 wherein the content value includes at least a 
portion of a message. 

Claim 23 (Original): The system of claim 21, wherein the content value includes at least a 
portion of a URL. 

Claim 24 (Original): The system of claim 21, wherein the content value is a hash of the 
content value included in the event. 

Claim 25 (Original): The system of claim 15, wherein the cluster host is further adapted to 
determine a metric value for an entry of the master screening table, the metric indicating that the 
entry of the master screening table corresponds to an abusive request. 
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Claim 26 (Original): The system of claim 25, wherein the cluster host is further adapted to 
set a block value associated with the entry in response to the metric value. 

Claim 27 (Original): The system of claim 25, wherein the cluster host is adapted to 
determine an average metric value from the metric value and a set of previous metric values and to 
set a block value associated with the entry in response to the average metric value. 

Claim 28 (Original): The system of claim 15, wherein the cluster host is adapted to 
determine a first sub-metric value from the entry, to determine a second sub-metric value from an 
entry of a second master screening table, and to determine the metric value from a weighted 
combination of the first and second sub-metric values. 

Claim 29 (Currently Amended): The method system of claim 15, wherein the predetermined 
value is zero. 

Claims 30-45 (Canceled) 

Claim 46 (New): The system of claim 15, wherein each of the plurality of server computers 
is further adapted to select a second table entry as a new selected table entry in response to receiving 
the event. 

Claim 47 (New): The system of claim 15, wherein each of the plurality of server computers 
is further adapted to select a second table entry as a new selected table entry in response to the event 
identification failing to match an event identification associated with the selected-table entry. 

Claim 48 (New): The system of claim 15, wherein each of the plurality of server computers 
is further adapted to disregard the event in response to the metric value crossing a threshold value. 

Claim 49 (New): The system of claim 15, wherein each of the plurality of server computers 
is further adapted to terminate a connection used to receive the event in response to the metric value 
crossing a threshold value. 

Claim 50 (New): The system of claim 15, wherein each of the plurality of server computers 
is further adapted to return an error message in response to the event in response to the metric value 
crossing a threshold value. 
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